1. Field of the Invention
The present invention relates to processors which utilize a clock source to maintain operation and more particularly to a plurality of processors which need to be locked into a synchronous operation with each other by a clock. The present invention is an improvement over copending application of J. R. Goetz entitled "Interrupt Driven, Separately Clocked, Fault Tolerant Processor Sychronization," Ser. No. 07/711,638, filed Jun. 6, 1991, no U.S. Pat. No. 5,233,615 and assigned to the assignee of the present invention.
2. Description of the Prior Art
Some systems require that certain control functions be performed in a redundant manner to prevent faulty operation in the event of a failure in one or more of the redundant control systems. In aircraft operation it is critical that the control thereof never be lost by faulty operation of the control system, and accordingly, two, three and even four parallel control systems, each using separate sensors, information processors and control devices may be employed. The multiple processors receive the same input data and are supposed to produce the same output signals unless something has gone wrong in one of the systems. To determine inconsistencies the outputs are sent to a voter where they are compared, and thus assure that the output data is consistent. This process is often impeded by the clocks in each processor not being exactly synchronized with each other. Although voters are capable of handling minor time differences from each processor, when data is processed at slightly different times in each processor, over a period of time, the difference accumulates so that the output data from one processor will differ more and more with data from another processor until the voter cannot handle the difference and meaningful comparisons become impossible.
Some prior art systems utilize a single clock for all of the processors and while this may prevent the problem with synchronism, it produced the problem of the failure of the single clock. Without redundant clocks, the tolerance for failure rate, although small, is still too large for the desired safety requirements.
In the above referred to copending application, a counter is employed in each processor to count the clock cycles from the clock and to process the data in each processor according to a predetermined number of clock cycles counted. The predetermined number is chosen so as to be sufficient for the processor to be able to perform the processing of a certain number of tasks. After the predetermined number is counted, the counter sends a signal to a set/reset flip flop which then commands the processor to stop processing data for a short period of time. Subsequently, an interrupt signal from an external source resets the flip flop, and through an interrupt controller in each processor, commands all of the processors to begin processing data again. During this time frame the output from each processor will not be different by an amount more than the voter can handle and, accordingly, the voter receives the exact same data from each processor during each such time frame.
One problem with the above referred-to copending application is the fact that the processors require a flip flop to shut them down after each time frame. This is unnecessary hardware which adds to the cost and weight of the system.